Legal

Privacy policy

This is a convenience translation of the German Datenschutzerklärung. Where the two differ, the German version is the binding one.

1. Privacy at a glance

This website is static. It sets no cookies, embeds no external services (fonts, images and videos are hosted on the same server) and uses no analytics or tracking tools. Two exceptions: the interactive demos under /demo/ store input and settings locally in your browser (section 6), and the contact form transmits your details to a server function in Frankfurt am Main, which forwards them to our mailbox (section 7). Personal data is processed only to the extent required for the technical operation of the website and for your enquiry.

2. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

3. Hosting

This website is hosted by an external provider. The content is delivered by:

Vercel provides the technical infrastructure through which this website is delivered and, in doing so, processes on our behalf the data generated when the website is accessed (see “Server log files”). The legal basis is our legitimate interest in a reliable and secure provision of the website (Art. 6(1)(f) GDPR). A data processing agreement (Data Processing Addendum) pursuant to Art. 28 GDPR is in place with Vercel. Vercel runs its infrastructure on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg). The domain is managed through IONOS SE.

Data transfer to the USA

Vercel Inc. is based in the USA. The content of the website is delivered through Vercel's worldwide network. In the process, personal data, in particular the IP address and the other connection data of a request (see “Server log files”), may also be transmitted to Vercel servers in the USA, for example for platform logs, security functions and support. The safeguards within the meaning of Art. 44 et seq. GDPR are the Standard Contractual Clauses of the EU Commission, which form part of the data processing agreement with Vercel; according to its own statement, Vercel Inc. is also certified under the EU-US Data Privacy Framework. Despite these safeguards, a level of data protection comparable in every respect to that of the EU cannot be fully guaranteed for the USA; in particular, access by US authorities cannot be entirely ruled out. The server function that processes the content of the contact form, by contrast, runs in the Frankfurt am Main region (see section 7).

Server log files

When the website is accessed, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. This is in particular:

• IP address of the accessing device
• date and time of access
• name and URL of the retrieved file
• amount of data transferred and notification of successful retrieval
• browser type and version and the operating system used
• referrer URL (the page visited before)

This data is not merged with other data sources and serves solely the technical provision, stability and security of the website. The legal basis is Art. 6(1)(f) GDPR. These logs are kept by Vercel as the platform operator; we ourselves do not evaluate them, do not store them separately and keep no access logs of our own. Vercel deletes them automatically; the retention period depends on the booked plan and, to our knowledge, is a few days, in any case less than 30 days. The same applies to the logs of the contact form's server function: they contain the time, status and duration of the call, but not the content of the message or the sender's details.

4. SSL/TLS encryption

For security reasons this website uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of your browser (“https://”) and the padlock symbol.

5. Fonts, images and videos

All fonts used on this website (Source Serif 4, Inter and JetBrains Mono, and in the website copy under /demo/imstudios/ Playfair Display and Archivo) are stored locally on this website's server and delivered from there. No connection is made to servers of Google or other providers of web fonts; in particular, your IP address is not transmitted to such providers. The same applies to all images and videos: they are delivered exclusively from this website. No maps, social media elements, buttons or other third-party content are embedded.

6. Local storage in the interactive demos

Under /demo/ there are two interactive demos: a dispatch dashboard with entirely invented sample data (/demo/dashboard/) and a copy of the website built for IM Studios (/demo/imstudios/). Both are delivered entirely from this website and make no connections to third parties. The contact form in the website copy sends nothing.

The dashboard keeps its editing state in your browser's session storage (sessionStorage) so that input survives a reload. This storage normally ends when the tab is closed; browsers that restore closed tabs may carry it over. You can reliably remove the state with the “Zurücksetzen” (reset) button. An earlier version of the dashboard stored the state permanently (localStorage); the current version removes any such entry automatically on every visit.

The website copy stores something only if you explicitly choose a language via its language switch; it remembers that choice (localStorage) until you remove it through your browser's settings. The default setting is not stored. Whether the intro has already played is held by the copy only in the memory of the open page, not on your device.

All of this remains exclusively on your device and is not transmitted to us or to third parties. The dashboard is intended for invented data; what you enter there is seen only by you. Both kinds of storage serve solely the function you yourself triggered (editing in the dashboard, choosing a language in the copy) and are therefore exempt from consent under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The rest of the website uses no storage on your device whatsoever.

7. Contact form

When you submit the contact form, the details you entered (chosen topic, name, company, e-mail address and content of the message) are transmitted to a server function of this website and forwarded from there via an encrypted SMTP connection to our e-mail mailbox. The server function runs in the Frankfurt am Main region; the mailbox is held with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The content of the message is therefore processed in Frankfurt and delivered to Germany. Independently of this, Vercel processes the connection data of the request (IP address, time, technical metadata) as with any other access to this website, including outside the EU (see section 3); when accessed from outside the EU, the request may also travel to the function via a Vercel network node near the sender. The details from the form are not stored on the server but processed exclusively for sending.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry). Providing a name and company is voluntary; without an e-mail address and a message we cannot answer the enquiry.

To protect against automated mass requests, the server function processes the sender's IP address transiently in the memory of the running function instance for at most ten minutes, in order to limit the number of requests per period; a count of sent messages without reference to the IP address is kept for at most one hour. There is no permanent storage: the IP address is neither written to a storage medium nor logged nor transmitted with the message by our function. Vercel's platform logs (see section 3) are a separate matter. In addition, before sending, your browser solves a small computational puzzle set by our server function (proof of work). This runs unnoticed in the background, processes no information about you, stores nothing on your device and involves no third party; for that reason no captcha service is used. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

If sending fails for technical reasons, the website offers you, in the message below the form, a pre-filled e-mail draft for your own e-mail program. The previously attempted form submission may already have reached our infrastructure, for example if the error only occurs when forwarding to the mailbox. The additional e-mail is sent only when you send it yourself from your e-mail program.

8. Contact by e-mail

If you contact us by e-mail at info@fairwaydevs.com, we process the details you provide (for example name, company, e-mail address and content of the message) exclusively to handle your enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry). Enquiries that do not lead to an engagement are deleted no later than six months after the last message. If an engagement comes about, we keep the related business correspondence (quote, order, acceptance and the associated correspondence) for six years and invoices and accounting records for eight years (Section 147(1) and (3) of the German Fiscal Code, AO). The period begins at the end of the calendar year in which the document was created (Section 147(4) AO) and is extended only insofar as the documents are relevant to a tax assessment that has not yet been completed. Other project documents not subject to a retention obligation are deleted no later than three years after the end of the project, once the regular limitation period for contractual claims has expired (Section 195 of the German Civil Code, BGB). After that, the data is deleted.

9. Your rights

As a data subject you have the following rights:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

To exercise these rights, an informal message to info@fairwaydevs.com is sufficient.

10. Right to object

Insofar as the processing of your data is based on Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent authority includes the supervisory authority of the German state in which the controller is based (Baden-Württemberg: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

Last updated: October 2026